Microsoft Entra groups
What it is
A group is a container in Microsoft Entra ID that holds multiple members (users, devices, other groups) so you can assign permissions or policies to many principals at once.
Why it exists
Assigning access per-user doesn’t scale. Groups are the best practice for RBAC and Entra-role assignment: give the group the role, add members to the group, and membership changes propagate automatically.
Key ideas
- Types — Assigned (static, you pick members) vs Dynamic (membership computed from rules on user/device attributes, e.g. “all users in the Accounting department”).
- Nesting — groups can contain other groups, but some role assignments don’t support transitive membership.
- Group roles — a central Entra admin can manage group lifecycle; options control who can create groups (self-service).
How it fits (diagram)
Exam notes
- Assign RBAC + Entra roles to groups, not individuals (most defensible design).
- Dynamic groups are a recurring AZ-104 concept — membership updates automatically based on attributes.
- Know the difference between Assigned and Dynamic membership types.
Related
entraid · user-account · rbac · role-assignment
📘 Source: Microsoft Learn — Groups